While "useful service" may be generous wording, in my own experience, when given the option between "pentesting" and "ransom+patching", most corporations would prefer the third, cheaper option: do nothing.
If we're unable to constructively reform the regulator a genuine (though politically untenable) alternative would be to remove criminal penalties for intrusion and publication of private data provided that no physical damage was done and no disruption to daily operations occurred. Effectively legalizing blackmail of data breach and cryptominers.